=== wp_headers ===
Contributors: smeans@gmail.com
Tags: headers, security, http, meta, seo, cache
Requires at least: 5.6
Tested up to: 6.6
Requires PHP: 7.2
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Inject HTTP headers globally and per-post using the `wp_headers` filter.

== Description ==
This plugin adds a global settings page (Settings → WP Headers) where you can enter HTTP headers as plain text, one per line in the format:

    Header-Name: value

It also adds a per-post meta box ("WP Headers (Per-Post)") on public post types that lets you override/extend headers for individual posts and pages.

On the front-end, the plugin merges:
1) WordPress-provided headers
2) Global headers (from settings)
3) Per-post headers (if viewing a singular post/page)

Later items win on key conflicts.

**Notes**
* Disallowed headers: Set-Cookie, Content-Length, Transfer-Encoding, Status.
* Header values are sanitized to avoid CR/LF injection.
* Admin pages are not affected.

== Installation ==
1. Upload the `wp_headers` folder to `/wp-content/plugins/` or use the "Upload Plugin" button to upload the zip.
2. Activate the plugin.
3. Go to **Settings → WP Headers** to define global headers.
4. Edit any post/page and use the **WP Headers (Per-Post)** meta box to set page-only headers.

== Frequently Asked Questions ==
= Can I add duplicate header names? =
WordPress sends headers as an associative array. If you need multiple values for the same header, combine them using commas per RFC (e.g., `Cache-Control: no-store, max-age=60`).

= Will this affect admin pages? =
No, the filter is bypassed for admin requests.

== Changelog ==
= 1.0.0 =
* Initial release.